v1.1.0 - .pth file detection & sudo-free execution

New features:
- Runs without sudo using Linux capabilities (CAP_BPF)
- .pth file planting detection (keip install, keip scan, keip python)
- Safe python execution wrapper with threat blocking

Improvements:
- Added .gitignore
- Fixed venv ownership in setup.sh
- Whitelist for safe .pth files (setuptools, namespace packages)
- Removed __pycache__ from repo

Author: Otsmane-Ahmed

.gitignore

@@ -0,0 +1,18 @@
+# Virtual environments
+keip-env/
+venv/
+.venv/
+
+# Python cache
+__pycache__/
+*.pyc
+*.pyo
+
+# Test files
+a.py
+test_script.py
+
+# OS files
+.DS_Store
+*.swp
+*.swo

check_compat.sh

@@ -36,6 +36,22 @@
     "pytest-cov.pth",             # pytest-cov
 }
 
+# Known safe .pth filename patterns (suffix-based)
+SAFE_PTH_PATTERNS = [
+    "-nspkg.pth",                 # namespace packages (zope, repoze, PasteScript, etc.)
+]
+
+
+def is_safe_pth(filepath):
+    """Check if a .pth file is in the whitelist (exact name or known pattern)."""
+    basename = os.path.basename(filepath)
+    if basename in SAFE_PTH_FILES:
+        return True
+    for pattern in SAFE_PTH_PATTERNS:
+        if basename.endswith(pattern):
+            return True
+    return False
+
 
 def get_site_packages_dirs():
     """Get all site-packages directories (global + active venv)."""
@@ -138,8 +154,7 @@ def audit_report(new_files, modified_files):
 
     # Check new files
     for filepath in new_files:
-        basename = os.path.basename(filepath)
-        if basename in SAFE_PTH_FILES:
+        if is_safe_pth(filepath):
             continue
         has_code, code_line = has_executable_code(filepath)
         if has_code:
@@ -157,8 +172,7 @@ def audit_report(new_files, modified_files):
 
     # Check modified files
     for filepath in modified_files:
-        basename = os.path.basename(filepath)
-        if basename in SAFE_PTH_FILES:
+        if is_safe_pth(filepath):
             continue
         has_code, code_line = has_executable_code(filepath)
         if has_code:
@@ -184,8 +198,7 @@ def scan_existing_pth_files(snapshot):
     """
     suspicious = False
     for filepath in snapshot:
-        basename = os.path.basename(filepath)
-        if basename in SAFE_PTH_FILES:
+        if is_safe_pth(filepath):
             continue
         has_code, code_line = has_executable_code(filepath)
         if has_code:
@@ -325,3 +338,4 @@ def run_python_safe(python_args):
         ret = run_pip_with_audit(sys.argv[1:])
         sys.exit(ret)
 
+